ERRG Achieved CMMC Compliance With an Egnyte Secure Data Enclave

Several years ago, Engineering/Remediation Resources Group (ERRG), a minority- and woman-owned small business providing environmental remediation and munitions response services, was at a crossroads. The deadline for CMMC compliance—a new federal regulation requiring companies working with the Department of Defense (DoD) to demonstrate cybersecurity controls supporting the NIST SP 800-171 regulation—was approaching rapidly. 

“With about 80% of our revenue coming from federal government contracts, we had a choice,” says Brad Hall, Chief Technology Officer at ERRG. “We either get compliant with CMMC or we cease to exist.”

Based on what they’d observed in other companies, achieving CMMC compliance was no walk in the park. “Software is a major compliance resource, and we saw companies make software vendor selection choices that really hamstrung them in the end,” says Hall. “After seeing the challenges and dysfunction they ran into, we didn’t want to suffer the same fate.”

Since partnering with Egnyte, ERRG has successfully achieved CMMC Level 2 compliance, completing their third-party assessment ahead of the proposed deadline. Throughout the process, they were assisted by Network Coverage, a national Managed Services Provider and CMMC Registered Provider Organization that helped ERRG to achieve their compliance goals.

Challenge: Find a CMMC-Ready System Without Disrupting Workflows

ERRG used Microsoft SharePoint for its storage, monitoring, and file-level access control. But the system was clunky and inefficient, and the team was starting to lose patience. “It was an old system that required a lot of overhead and IT support,” explains Hall. More importantly, the team worried that the on-premises SharePoint environment, as a legacy system, wasn’t capable of facilitating compliance with new regulations.

Their suspicions were confirmed when ERRG suffered a ransomware attack in 2021. “This was an eye-opening event for us,” says Hall. “It was exactly the kind of attack that the CMMC requirements aim to prevent. We knew we needed a new partner to prevent it from happening again.”

But a successful compliance journey would involve more than finding software that had the necessary security capabilities. It also meant minimizing disruption to a team that never had to focus on cybersecurity prior to CMMC. “Our staff consists largely of engineers, geologists, and construction managers. In roles like those, cybersecurity is the last thing on your mind,” explains Hall. “They were accustomed to being able to access any file at any time, and CMMC would change that. So we needed to educate them a bit, and we needed a solution that would allow us to get fully compliant without being too disruptive to the team.”

Solution: Egnyte’s Unified Solution Accelerates the CMMC Journey

Within a month of the ransomware attack, ERRG made the decision to move file storage off its legacy SharePoint environment and into the cloud with Egnyte. They began migrating files into the new system and quickly discovered that the Egnyte platform could also become a key resource for addressing CUI security.

Two significant aspects of Egnyte’s functionality were particularly impactful in empowering ERRG to reach the level of CUI security and control necessary for CMMC compliance:

• Sensitive data discovery and classification
  Egnyte made it easy to zero in on particular files containing sensitive content that the team needed to address. Considering the volume of content ERRG works with, this would otherwise have been a needle-in-a-haystack exercise. “The security and governance tools in Egnyte were great. We’d never seen anything like them,” comments Hall. “The reports that we get from the system show us exactly which folders contain sensitive information like PII, so we know which ones are still out of compliance and need to be cleaned up.”
• Access and sharing protection
  The team was able to set granular file access permissions based on parameters such as username and role, ensuring that only the right people are able to view, modify, or delete any given file–all while still making it easy for people to locate and access the files they need to see. “This made it much easier to make our data more secure and controlled while still allowing people to get their jobs done,” says Hall. “Making the major changes in access control that CMMC requires could have been really disruptive, but with Egnyte, we were able to make it as smooth as possible.”

Benefits: Racing Toward Compliance with the Wind at their Back

The switch to Egnyte empowered ERRG to align their CUI security with the federal government’s requirements and race toward full CMMC Level 2 compliance. “Coming on board with Egnyte was a huge improvement,” says Hall. “The security level is far better than it ever was before. We never dreamed of being in the position we’re in now.”

ERRG also benefited from aspects that extended beyond compliance. “We brought Egnyte on for CMMC, but the platform has also made things much easier and more efficient in areas like collaboration,” Hall explains.

Today, the firm has successfully completed its formal CMMC Level 2 assessment, achieving compliance ahead of the DoD’s deadline. Along the way, they had access to Egnyte’s functionality, and to its team’s deep technical CMMC expertise, which gave them peace of mind that they managed the transition properly. This was further driven by the Network Coverage team’s expertise, not only as a premier Egnyte partner but in aiding in remediation and assessment efforts as ERRG completed its certification process.

The decision to choose Egnyte over Microsoft GCC High—the path most of ERRG’s peers took for CMMC compliance—has proven particularly wise. Hall pushed back against his leadership team’s initial instinct to follow the crowd. “The CEO raves about that decision with everybody that we work with,” says Hall. “Every time she sees other companies struggling and having issues, she just sits back and smiles because we avoided that minefield and went a different route.” Today, partner companies that utilize Microsoft GCC High regularly ask ERRG to host joint project folders in Egnyte because their own environments can’t support the collaboration they require.

ERRG also turned Egnyte’s role-based access control into an active compliance enforcement mechanism. Employees must complete required DoD CUI training annually, and if they let it lapse, they’re removed from the Egnyte access group instantly. “If someone doesn’t maintain their required DoD training, we simply go into Egnyte and say, okay, you’re out of that group—pop, they’re gone,” explains Hall. “That forces them to go get their training done.” Refined access control is important to ERRG, because the team manages CUI across project folders and proposals, applying role-based permissions broadly while drilling down to individual folder-level access for more specific sensitive content.

Ongoing Impact: CMMC Compliance With a Technology Provider That Values Customer Feedback

When it came time for their formal CMMC assessment, Egnyte’s portion of the process was remarkably smooth. ERRG’s assessors used a live, show-and-tell approach—reviewing systems in real-time over four days—and Egnyte sailed through without friction. “It was the most painless part of the whole thing,” says Hall. Compliance Center’s accumulating body of evidence was immediately visible and credible to the assessment team, and Egnyte’s customer success team resolved the one question that arose—around password storage security—overnight.

For Hall, what truly differentiates Egnyte goes beyond the company’s EgnyteGov and data governance solutions. “The openness and willingness to modify the system, grow the system, and take customer feedback and suggestions—we’ve seen several things come out because of comments we’ve made. That is rare in a company,” he says. He describes Egnyte’s culture as entrepreneurial: still treating itself like a startup, hungry to grow and responsive to the people using its platform. 

Hall’s advice to others beginning the CMMC journey: Establish your foundational platform first, then build your MSP partnership around it. “Figure out what your foundation is going to be,” he says. “For us, Egnyte was the foundational element. We knew we wanted to start there and grow from there.”